OLD | NEW |
(Empty) | |
| 1 /* |
| 2 ** This module interfaces SQLite to the Google OSS-Fuzz, fuzzer as a service. |
| 3 ** (https://github.com/google/oss-fuzz) |
| 4 */ |
| 5 #include <stddef.h> |
| 6 #include <stdint.h> |
| 7 #include "sqlite3.h" |
| 8 |
| 9 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK |
| 10 /* |
| 11 ** Progress handler callback |
| 12 */ |
| 13 static int progress_handler(void *pReturn) { |
| 14 return *(int*)pReturn; |
| 15 } |
| 16 #endif |
| 17 |
| 18 /* |
| 19 ** Callback for sqlite3_exec(). |
| 20 */ |
| 21 static int exec_handler(void *pCnt, int argc, char **argv, char **namev){ |
| 22 int i; |
| 23 if( argv ){ |
| 24 for(i=0; i<argc; i++) sqlite3_free(sqlite3_mprintf("%s", argv[i])); |
| 25 } |
| 26 return ((*(int*)pCnt)--)<=0; |
| 27 } |
| 28 |
| 29 /* |
| 30 ** Main entry point. The fuzzer invokes this function with each |
| 31 ** fuzzed input. |
| 32 */ |
| 33 int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 34 int progressArg = 0; /* 1 causes progress handler abort */ |
| 35 int execCnt = 0; /* Abort row callback when count reaches zero */ |
| 36 char *zErrMsg = 0; /* Error message returned by sqlite_exec() */ |
| 37 sqlite3 *db; /* The database connection */ |
| 38 uint8_t uSelector; /* First byte of input data[] */ |
| 39 int rc; /* Return code from various interfaces */ |
| 40 char *zSql; /* Zero-terminated copy of data[] */ |
| 41 |
| 42 if( size<3 ) return 0; /* Early out if unsufficient data */ |
| 43 |
| 44 /* Extract the selector byte from the beginning of the input. But only |
| 45 ** do this if the second byte is a \n. If the second byte is not \n, |
| 46 ** then use a default selector */ |
| 47 if( data[1]=='\n' ){ |
| 48 uSelector = data[0]; data += 2; size -= 2; |
| 49 }else{ |
| 50 uSelector = 0xfd; |
| 51 } |
| 52 |
| 53 /* Open the database connection. Only use an in-memory database. */ |
| 54 rc = sqlite3_open_v2("fuzz.db", &db, |
| 55 SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_MEMORY, 0); |
| 56 if( rc ) return 0; |
| 57 |
| 58 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK |
| 59 /* Bit 0 of the selector enables progress callbacks. Bit 1 is the |
| 60 ** return code from progress callbacks */ |
| 61 if( uSelector & 1 ){ |
| 62 sqlite3_progress_handler(db, 4, progress_handler, (void*)&progressArg); |
| 63 } |
| 64 #endif |
| 65 uSelector >>= 1; |
| 66 progressArg = uSelector & 1; uSelector >>= 1; |
| 67 |
| 68 /* Bit 2 of the selector enables foreign key constraints */ |
| 69 sqlite3_db_config(db, SQLITE_DBCONFIG_ENABLE_FKEY, uSelector&1, &rc); |
| 70 uSelector >>= 1; |
| 71 |
| 72 /* Remaining bits of the selector determine a limit on the number of |
| 73 ** output rows */ |
| 74 execCnt = uSelector + 1; |
| 75 |
| 76 /* Run the SQL. The sqlite_exec() interface expects a zero-terminated |
| 77 ** string, so make a copy. */ |
| 78 zSql = sqlite3_mprintf("%.*s", (int)size, data); |
| 79 sqlite3_exec(db, zSql, exec_handler, (void*)&execCnt, &zErrMsg); |
| 80 |
| 81 /* Cleanup and return */ |
| 82 sqlite3_free(zErrMsg); |
| 83 sqlite3_free(zSql); |
| 84 sqlite3_close(db); |
| 85 return 0; |
| 86 } |
OLD | NEW |